From 431e91b460fcbdc6907f48ca3b0d7a9e9929cf97 Mon Sep 17 00:00:00 2001
From: ihuibin <bin.hui@daocloud.io>
Date: Thu, 9 Jun 2022 14:55:42 +0800
Subject: [PATCH] Create windows.md (#34006)

* Create windows.md

Signed-off-by: bin.hui <bin.hui@daocloud.io>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Sean <me@sean.taipei>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Sean <me@sean.taipei>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Sean <me@sean.taipei>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update content/zh/docs/tasks/debug/debug-cluster/windows.md

Co-authored-by: Qiming Teng <tengqm@outlook.com>

* Update windows.md

Signed-off-by: bin.hui <bin.hui@daocloud.io>

Co-authored-by: Sean <me@sean.taipei>
Co-authored-by: Qiming Teng <tengqm@outlook.com>
---
 .../docs/tasks/debug/debug-cluster/windows.md | 314 ++++++++++++++++++
 1 file changed, 314 insertions(+)
 create mode 100644 content/zh/docs/tasks/debug/debug-cluster/windows.md

diff --git a/content/zh/docs/tasks/debug/debug-cluster/windows.md b/content/zh/docs/tasks/debug/debug-cluster/windows.md
new file mode 100644
index 0000000000..802ffeec8e
--- /dev/null
+++ b/content/zh/docs/tasks/debug/debug-cluster/windows.md
@@ -0,0 +1,314 @@
+---
+title: Windows 调试小技巧
+content_type: concept
+---
+<!--
+title: Windows debugging tips
+content_type: concept
+-->
+<!-- overview -->
+
+<!-- body -->
+<!-- 
+## Node-level troubleshooting {#troubleshooting-node}
+
+1. My Pods are stuck at "Container Creating" or restarting over and over
+
+   Ensure that your pause image is compatible with your Windows OS version.
+   See [Pause container](/docs/setup/production-environment/windows/intro-windows-in-kubernetes#pause-container)
+   to see the latest / recommended pause image and/or get more information.
+
+   {{< note >}}
+   If using containerd as your container runtime the pause image is specified in the
+   `plugins.plugins.cri.sandbox_image` field of the of config.toml configration file.
+   {{< /note >}}
+-->
+## 工作节点级别排障 {#troubleshooting-node}
+
+1. 我的 Pod 都卡在 “Container Creating” 或者不断重启
+
+   确保你的 pause 镜像跟你的 Windows 版本兼容。
+   查看 [Pause 容器](zh/docs/setup/production-environment/windows/intro-windows-in-kubernetes#pause-container)
+   以了解最新的或建议的 pause 镜像，或者了解更多信息。
+
+   {{< note >}}
+   如果你使用了 containerd 作为你的容器运行时，pause 镜像在 config.toml 配置文件的
+   `plugins.plugins.cri.sandbox_image` 中指定。
+   {{< /note >}}
+<!-- 
+2. My pods show status as `ErrImgPull` or `ImagePullBackOff`
+
+   Ensure that your Pod is getting scheduled to a [compatable](https://docs.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility) Windows Node.
+
+   More information on how to specify a compatable node for your Pod can be found in [this guide](docs/setup/production-environment/windows/user-guide-windows-containers/#ensuring-os-specific-workloads-land-on-the-appropriate-container-host).
+-->
+2. 我的 pod 状态显示 'ErrImgPull' 或者 ‘ImagePullBackOff’
+
+   保证你的 Pod 被调度到[兼容的](https://docs.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility) Windows 节点上。
+
+   关于如何为你的 Pod 指定一个兼容节点，
+   的更多信息可以查看这个指可以查看[这个指南](/zhdocs/setup/production-environment/windows/user-guide-windows-containers/#ensuring-os-specific-workloads-land-on-the-appropriate-container-host)以了解更多的信息。
+<!-- 
+## Network troubleshooting {#troubleshooting-network}
+
+1. My Windows Pods do not have network connectivity
+
+   If you are using virtual machines, ensure that MAC spoofing is **enabled** on all
+   the VM network adapter(s).
+-->
+## 网络排障 {#troubleshooting-network}
+
+1. 我的 Windows Pod 没有网络连接
+
+   如果你使用的是虚拟机，请确保所有 VM 网卡上都已启用 MAC spoofing。
+<!-- 
+2. My Windows Pods cannot ping external resources
+
+   Windows Pods do not have outbound rules programmed for the ICMP protocol. However,
+   TCP/UDP is supported. When trying to demonstrate connectivity to resources
+   outside of the cluster, substitute `ping <IP>` with corresponding
+   `curl <IP>` commands.
+
+   If you are still facing problems, most likely your network configuration in
+   [cni.conf](https://github.com/Microsoft/SDN/blob/master/Kubernetes/flannel/l2bridge/cni/config/cni.conf)
+   deserves some extra attention. You can always edit this static file. The
+   configuration update will apply to any new Kubernetes resources.
+
+   One of the Kubernetes networking requirements
+   (see [Kubernetes model](/docs/concepts/cluster-administration/networking/)) is
+   for cluster communication to occur without
+   NAT internally. To honor this requirement, there is an
+   [ExceptionList](https://github.com/Microsoft/SDN/blob/master/Kubernetes/flannel/l2bridge/cni/config/cni.conf#L20)
+   for all the communication where you do not want outbound NAT to occur. However,
+   this also means that you need to exclude the external IP you are trying to query
+   from the `ExceptionList`. Only then will the traffic originating from your Windows
+   pods be SNAT'ed correctly to receive a response from the outside world. In this
+   regard, your `ExceptionList` in `cni.conf` should look as follows:
+
+   ```conf
+   "ExceptionList": [
+                   "10.244.0.0/16",  # Cluster subnet
+                   "10.96.0.0/12",   # Service subnet
+                   "10.127.130.0/24" # Management (host) subnet
+               ]
+   ```
+-->
+2. 我的 Windows Pod 不能 ping 通外界资源
+
+   Windows Pod 没有为 ICMP 协议编写出站规则，但 TCP/UDP 是支持的。当试图演示与集群外部资源的连接时，可以把 `ping <IP>` 替换为 `curl <IP>` 命令。
+
+   如果你仍然遇到问题，很可能你需要额外关注
+   [cni.conf](https://github.com/Microsoft/SDN/blob/master/Kubernetes/flannel/l2bridge/cni/config/cni.conf)
+   的配置。你可以随时编辑这个静态文件。更新配置将应用于新的 Kubernetes 资源。
+
+   Kubernetes 的网络需求之一 (查看 [Kubernetes 模型](/zh/docs/concepts/cluster-administration/networking/)) 
+   是集群通信不需要内部的 NAT。
+   为了遵守这一要求， 对于你不希望发生的出站 NAT 通信，这里有一个
+   [ExceptionList](https://github.com/Microsoft/SDN/blob/master/Kubernetes/flannel/l2bridge/cni/config/cni.conf#L20) 。
+   然而，这也意味着你需要从 `ExceptionList` 中去掉你试图查询的外部IP。
+   只有这样，来自你的 Windows Pod 的流量才会被正确地 SNAT 转换，以接收来自外部环境的响应。
+   就此而言，你的 `cni.conf` 中的 `ExceptionList` 应该如下所示：
+
+   ```conf
+   "ExceptionList": [
+                   "10.244.0.0/16",  # Cluster subnet
+                   "10.96.0.0/12",   # Service subnet
+                   "10.127.130.0/24" # Management (host) subnet
+               ]
+   ```
+<!--  
+3. My Windows node cannot access `NodePort` type Services
+
+   Local NodePort access from the node itself fails. This is a known
+   limitation. NodePort access works from other nodes or external clients.
+
+4. vNICs and HNS endpoints of containers are being deleted
+
+   This issue can be caused when the `hostname-override` parameter is not passed to
+   [kube-proxy](/docs/reference/command-line-tools-reference/kube-proxy/). To resolve
+   it, users need to pass the hostname to kube-proxy as follows:
+
+   ```powershell
+   C:\k\kube-proxy.exe --hostname-override=$(hostname)
+   ```
+-->
+3. 我的 Windows 节点无法访问 `NodePort` 类型服务
+
+   从节点本身访问本地 NodePort 失败，是一个已知的限制。你可以从其他节点或外部客户端正常访问 NodePort。
+
+4. 容器的 vnic 和 HNS endpoints 正在被删除
+
+   当 `hostname-override` 参数没有传递给 [kube-proxy](/zh/docs/reference/command-line-tools-reference/kube-proxy/)
+   时可能引发这一问题。想要解决这个问题，用户需要将主机名传递给 kube-proxy，如下所示：
+
+   ```powershell
+   C:\k\kube-proxy.exe --hostname-override=$(hostname)
+   ```
+<!-- 
+5. My Windows node cannot access my services using the service IP
+
+   This is a known limitation of the networking stack on Windows. However, Windows Pods can access the Service IP.
+
+6. No network adapter is found when starting the kubelet
+
+   The Windows networking stack needs a virtual adapter for Kubernetes networking to work.
+   If the following commands return no results (in an admin shell),
+   virtual network creation — a necessary prerequisite for the kubelet to work — has failed:
+
+   ```powershell
+   Get-HnsNetwork | ? Name -ieq "cbr0"
+   Get-NetAdapter | ? Name -Like "vEthernet (Ethernet*"
+   ```
+
+   Often it is worthwhile to modify the [InterfaceName](https://github.com/microsoft/SDN/blob/master/Kubernetes/flannel/start.ps1#L7) parameter of the start.ps1 script,
+   in cases where the host's network adapter isn't "Ethernet".
+   Otherwise, consult the output of the `start-kubelet.ps1` script to see if there are errors during virtual network creation.
+-->
+5. 我的 Windows 节点无法通过服务 IP 访问我的服务
+
+   这是 Windows 上网络栈的一个已知限制。但是 Windows Pod 可以访问 Service IP。
+
+6. 启动 kubelet 时找不到网络适配器
+
+   Windows 网络栈需要一个虚拟适配器才能使 Kubernetes 网络工作。
+   如果以下命令没有返回结果（在管理员模式的 shell 中），
+   则意味着创建虚拟网络失败，而虚拟网络的存在是 kubelet 正常工作前提：
+
+   ```powershell
+   Get-HnsNetwork | ? Name -ieq "cbr0"
+   Get-NetAdapter | ? Name -Like "vEthernet (Ethernet*"
+   ```
+
+   如果主机的网络适配器不是 "Ethernet"，通常有必要修改 `start.ps1` 脚本的
+   [InterfaceName](https://github.com/microsoft/SDN/blob/master/Kubernetes/flannel/start.ps1#L7) 参数。
+   否则，如果虚拟网络创建过程出错，请检查 `start-kubelet.ps1` 脚本的输出。
+<!--    
+7. DNS resolution is not properly working
+
+   Check the DNS limitations for Windows in this [section](#dns-limitations).
+
+8. `kubectl port-forward` fails with "unable to do port forwarding: wincat not found"
+
+   This was implemented in Kubernetes 1.15 by including `wincat.exe` in the pause infrastructure container `mcr.microsoft.com/oss/kubernetes/pause:3.6`.
+   Be sure to use a supported version of Kubernetes.
+   If you would like to build your own pause infrastructure container be sure to include [wincat](https://github.com/kubernetes/kubernetes/tree/master/build/pause/windows/wincat).
+-->
+7. DNS 解析工作异常
+
+   在[本节](#dns-limitations)中了解 Windows 系统上的 DNS 限制。
+
+8. `kubectl port-forward` 失败，错误为 "unable to do port forwarding: wincat not found"
+
+   在 Kubernetes 1.15 中，pause 基础架构容器 `mcr.microsoft.com/oss/kubernetes/pause:3.6`
+   中包含 `wincat.exe` 来实现端口转发。
+   请确保使用 Kubernetes 的受支持版本。如果你想构建自己的 pause 基础架构容器，
+   请确保其中包含 [wincat](https://github.com/kubernetes/kubernetes/tree/master/build/pause/windows/wincat)。
+<!--   
+9. My Kubernetes installation is failing because my Windows Server node is behind a proxy
+
+   If you are behind a proxy, the following PowerShell environment variables must be defined:
+
+   ```PowerShell
+   [Environment]::SetEnvironmentVariable("HTTP_PROXY", "http://proxy.example.com:80/", [EnvironmentVariableTarget]::Machine)
+   [Environment]::SetEnvironmentVariable("HTTPS_PROXY", "http://proxy.example.com:443/", [EnvironmentVariableTarget]::Machine)
+   ```
+-->
+9. 我的 Kubernetes 安装失败，因为我的 Windows 服务器节点使用了代理服务器
+
+   如果使用了代理服务器，必须定义下面的 PowerShell 环境变量：
+
+   ```PowerShell
+   [Environment]::SetEnvironmentVariable("HTTP_PROXY", "http://proxy.example.com:80/", [EnvironmentVariableTarget]::Machine)
+   [Environment]::SetEnvironmentVariable("HTTPS_PROXY", "http://proxy.example.com:443/", [EnvironmentVariableTarget]::Machine)
+   ```
+<!-- 
+### Flannel troubleshooting
+
+1. With Flannel, my nodes are having issues after rejoining a cluster
+
+   Whenever a previously deleted node is being re-joined to the cluster, flannelD
+   tries to assign a new pod subnet to the node. Users should remove the old pod
+   subnet configuration files in the following paths:
+
+   ```powershell
+   Remove-Item C:\k\SourceVip.json
+   Remove-Item C:\k\SourceVipRequest.json
+   ```
+-->
+## Flannel 故障排查 {#troubleshooting-network}
+
+1. 使用 Flannel 时，我的节点在重新加入集群后出现问题
+
+   当先前删除的节点重新加入集群时, flannelD 尝试为节点分配一个新的 Pod 子网。
+   用户应该在以下路径中删除旧的 Pod 子网配置文件：
+
+   ```powershell
+   Remove-Item C:\k\SourceVip.json
+   Remove-Item C:\k\SourceVipRequest.json
+   ```
+<!-- 
+2. Flanneld is stuck in "Waiting for the Network to be created"
+
+   There are numerous reports of this [issue](https://github.com/coreos/flannel/issues/1066);
+   most likely it is a timing issue for when the management IP of the flannel network is set.
+   A workaround is to relaunch `start.ps1` or relaunch it manually as follows:
+
+   ```powershell
+   [Environment]::SetEnvironmentVariable("NODE_NAME", "<Windows_Worker_Hostname>")
+   C:\flannel\flanneld.exe --kubeconfig-file=c:\k\config --iface=<Windows_Worker_Node_IP> --ip-masq=1 --kube-subnet-mgr=1
+   ```
+-->
+2. Flanneld 卡在 "Waiting for the Network to be created"
+
+   关于这个[问题](https://github.com/coreos/flannel/issues/1066)有很多报告 ；
+   很可能是 flannel 网络管理 IP 的设置时机问题。
+   一个变通方法是重新启动 `start.ps1` 或按如下方式手动重启：
+
+   ```powershell
+   [Environment]::SetEnvironmentVariable("NODE_NAME", "<Windows 工作节点主机名>")
+   C:\flannel\flanneld.exe --kubeconfig-file=c:\k\config --iface=<Windows 工作节点 IP> --ip-masq=1 --kube-subnet-mgr=1
+   ```
+<!-- 
+3. My Windows Pods cannot launch because of missing `/run/flannel/subnet.env`
+
+   This indicates that Flannel didn't launch correctly. You can either try
+   to restart `flanneld.exe` or you can copy the files over manually from
+   `/run/flannel/subnet.env` on the Kubernetes master to `C:\run\flannel\subnet.env`
+   on the Windows worker node and modify the `FLANNEL_SUBNET` row to a different
+   number. For example, if node subnet 10.244.4.1/24 is desired:
+
+   ```env
+   FLANNEL_NETWORK=10.244.0.0/16
+   FLANNEL_SUBNET=10.244.4.1/24
+   FLANNEL_MTU=1500
+   FLANNEL_IPMASQ=true
+   ```
+-->
+3. 我的 Windows Pod 无法启动，因为缺少 `/run/flannel/subnet.env`
+
+   这表明 Flannel 没有正确启动。你可以尝试重启`flanneld.exe` 或者你可以将 Kubernetes 控制节点的
+   `/run/flannel/subnet.env` 文件手动拷贝到 Windows 工作节点上，放在 `C:\run\flannel\subnet.env`；
+   并且将 `FLANNEL_SUBNET` 行修改为不同取值。例如，如果期望节点子网为 10.244.4.1/24：
+
+   ```env
+   FLANNEL_NETWORK=10.244.0.0/16
+   FLANNEL_SUBNET=10.244.4.1/24
+   FLANNEL_MTU=1500
+   FLANNEL_IPMASQ=true
+   ```
+<!-- 
+### Further investigation
+
+If these steps don't resolve your problem, you can get help running Windows containers on Windows nodes in Kubernetes through:
+
+* StackOverflow [Windows Server Container](https://stackoverflow.com/questions/tagged/windows-server-container) topic
+* Kubernetes Official Forum [discuss.kubernetes.io](https://discuss.kubernetes.io/)
+* Kubernetes Slack [#SIG-Windows Channel](https://kubernetes.slack.com/messages/sig-windows)
+-->
+### 进一步探查   {#further-investigation}
+
+如果这些步骤都不能解决你的问题，你可以通过以下方式获得关于在 Kubernetes 中运行 Windows 容器的帮助：
+
+* StackOverflow [Windows Server Container](https://stackoverflow.com/questions/tagged/windows-server-container) topic
+* Kubernetes 官方论坛 [discuss.kubernetes.io](https://discuss.kubernetes.io/)
+* Kubernetes Slack [#SIG-Windows Channel](https://kubernetes.slack.com/messages/sig-windows)